An internal control perspective on the market value consequences of IT operational risk events

Research output: Contribution to journalArticlepeer-review

52 Scopus citations


IT internal controls are an important component of an organization's arsenal of internal controls. Upon conceptualizing failures of operational IT systems, or what we call IT operational risk events, as signals of IT internal control weaknesses, we theorize about these events' impact on internal control objectives in general and about how this impact is influenced by the regulatory environment in particular. We then perform an event study to examine the economic impact of a diversified sample of IT operational risk events from the U.S. financial services industry during 1985-2009. We specifically test the impact of contextual factors on the degree of this effect, including the events' target (confidentiality, integrity, or availability of IT assets), the source of disclosure (regulatory or voluntary), the enactment of the Sarbanes-Oxley Act, and firm-specific attributes. We find that investors penalize firms most strongly for experiencing events that compromise the availability of IT systems, consistent with our prediction that these events more negatively impact the reliability of financial reporting and the efficiency and effectiveness of operations. This result contrasts extant empirical studies that are predominantly concerned with information and security breaches. We find also that investors' penalty is the strongest for firms experiencing IT operational risk events that occurred after the passing of the Sarbanes-Oxley Act or were disclosed by a regulatory body. Finally, the market reaction is shown to be stronger for firms with high growth potential, firms that are larger, riskier, and are in the banking sector. Implications for research and practice are discussed along with directions for future research.

Original languageEnglish (US)
Pages (from-to)357-381
Number of pages25
JournalInternational Journal of Accounting Information Systems
Issue number4
StatePublished - Dec 2012


  • Confidentiality, integrity and availability of IT assets
  • Event study
  • Financial services
  • IT control weaknesses
  • IT operational risk events
  • Internal control objectives
  • Regulatory environment

ASJC Scopus subject areas

  • Management Information Systems
  • Accounting
  • Finance
  • Information Systems and Management


Dive into the research topics of 'An internal control perspective on the market value consequences of IT operational risk events'. Together they form a unique fingerprint.

Cite this